Removed interactive mode (is default now), moved some code to checkpw.h and many fixes.
This commit is contained in:
parent
6f859b18b2
commit
82aced57b6
5 changed files with 204 additions and 176 deletions
2
LICENSE
2
LICENSE
|
|
@ -1,4 +1,4 @@
|
|||
Copyright 2024 Johannes Findeisen <you@hanez.org>
|
||||
Copyright 2024 Johannes Findeisen
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
|
|
|
|||
2
Makefile
2
Makefile
|
|
@ -6,7 +6,9 @@ clean:
|
|||
|
||||
install:
|
||||
cp ./checkpw /usr/bin/
|
||||
cp ./checkpw.h /usr/include/
|
||||
|
||||
uninstall:
|
||||
rm -f /usr/bin/checkpw
|
||||
rm -f /usr/include/checkpw.h
|
||||
|
||||
|
|
|
|||
68
README.md
68
README.md
|
|
@ -4,84 +4,96 @@ checkpw is a program that checks the validity of a users password on a UNIX/PAM-
|
|||
|
||||
Currently only tested on Linux, but it should work on the [AIX](https://en.wikipedia.org/wiki/IBM_AIX), [DragonFly BSD](https://www.dragonflybsd.org/), [FreeBSD](https://www.freebsd.org/), [HP-UX](https://en.wikipedia.org/wiki/HP-UX), [Linux](https://kernel.org/), [macOS](https://en.wikipedia.org/wiki/MacOS), [NetBSD](https://netbsd.org/) and [Solaris](https://en.wikipedia.org/wiki/Oracle_Solaris) operating system too.
|
||||
|
||||
## The idea behind:
|
||||
## The idea
|
||||
|
||||
I needed a program to verify passwords of users on Linux based systems using PAM.
|
||||
I needed a program to verify passwords of users on Linux/UNIX systems using PAM that just return 0 on success and 1 on error.
|
||||
|
||||
Exactly a program like this... not more!
|
||||
|
||||
## Installation:
|
||||
|
||||
**WARNING:** Install this software with care. checkpw could easily be used for bruteforcing passwords from local users!
|
||||
## Building checkpw
|
||||
|
||||
```
|
||||
git clone https://git.xw3.org/xw3/checkpw.git
|
||||
cd checkpw
|
||||
make
|
||||
sudo make install
|
||||
```
|
||||
|
||||
The code only supports verifying passwords for user id 1000 by default. Look a the code for some compile time options!
|
||||
The code only supports verifying passwords for user id 1000 by default. Look at the file checkpw.h for some compile time options!
|
||||
|
||||
### Manual installation:
|
||||
### Custom build example
|
||||
|
||||
Set MAX_UID and MIN_UID in the code or you can compile checkpw without editing the code using the following command and install it manually:
|
||||
Set MAX_UID and MIN_UID at compile time:
|
||||
|
||||
```
|
||||
gcc -Wall -DMAX_UID=1000 -DMIN_UID=1000 -o checkpw checkpw.c -lpam -lpam_misc
|
||||
sudo cp ./checkpw /usr/bin/
|
||||
```
|
||||
|
||||
## Uninstall:
|
||||
## Installation
|
||||
|
||||
**WARNING:** Install this software with care. checkpw could easily be used for bruteforcing passwords from local users!
|
||||
|
||||
```
|
||||
sudo make install
|
||||
```
|
||||
|
||||
checkpw is installed to /usr/bin/.
|
||||
|
||||
checkpw.h is installed to /usr/include/ for use in other applications.
|
||||
|
||||
## Uninstall
|
||||
|
||||
```
|
||||
sudo make uninstall
|
||||
```
|
||||
|
||||
## Usage:
|
||||
## Usage
|
||||
|
||||
```
|
||||
checkpw -h
|
||||
Usage: checkpw [-u <username>] [-p <password>] [-i] [-v] [-h]
|
||||
Usage: checkpw [-u <username>] [-p <password>] [-v] [-V] [-h]
|
||||
|
||||
Options:
|
||||
-u <username> Specify username.
|
||||
-p <password> Specify password.
|
||||
-i Enable interactive mode to prompt for missing username/password.
|
||||
-v Enable verbose mode.
|
||||
-V Show program version.
|
||||
-V Print program version.
|
||||
-h Show this help.
|
||||
```
|
||||
|
||||
Returns 0 on success, 1 otherwise.
|
||||
|
||||
### Examples:
|
||||
|
||||
#### Interactive mode:
|
||||
You can also use checkpw even without installing by just running the following command:
|
||||
|
||||
```
|
||||
checkpw -i
|
||||
./checkpk
|
||||
```
|
||||
|
||||
#### Interactive mode only asking for a password:
|
||||
checkpw returns 0 on success, 1 otherwise.
|
||||
|
||||
### Examples
|
||||
|
||||
|
||||
#### Interactive mode asking for a username and a password
|
||||
|
||||
```
|
||||
checkpw -u hanez -i
|
||||
checkpw
|
||||
```
|
||||
|
||||
#### None interactive mode with username and password provided as arguments to checkpw:
|
||||
#### Interactive mode only asking for a password
|
||||
|
||||
```
|
||||
checkpw -u hanez
|
||||
```
|
||||
|
||||
#### None interactive mode with username and password provided as arguments to checkpw
|
||||
|
||||
```
|
||||
checkpw -u hanez -p password
|
||||
```
|
||||
|
||||
#### Request the result from the above commands:
|
||||
#### Request the result from the above commands
|
||||
|
||||
```
|
||||
echo $?
|
||||
```
|
||||
|
||||
## Links:
|
||||
## Links
|
||||
|
||||
- [https://cr.yp.to/checkpwd.html](https://cr.yp.to/checkpwd.html)
|
||||
- [https://pamtester.sourceforge.net/](https://pamtester.sourceforge.net/)
|
||||
|
|
|
|||
191
checkpw.c
191
checkpw.c
|
|
@ -1,119 +1,23 @@
|
|||
/**
|
||||
* checkpw is a program that checks the validity of a users password on a
|
||||
* Linux/PAM-based system.
|
||||
* UNIX/PAM-based system.
|
||||
*
|
||||
* Author: Johannes Findeisen <you@hanez.org> - 2024
|
||||
* License: MIT (see LICENSE)
|
||||
* License: Apache-2.0 (see LICENSE)
|
||||
*/
|
||||
|
||||
#include <pwd.h> // For struct passwd and getpwnam
|
||||
#include <security/pam_appl.h>
|
||||
#include <security/pam_misc.h>
|
||||
#include <stdbool.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <termios.h> // For terminal input settings
|
||||
#include <unistd.h> // For getopt and access to user info
|
||||
#include <termios.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#define MAX_USERNAME_LEN 32
|
||||
#define MAX_PASSWORD_LEN 256
|
||||
|
||||
#ifndef MAX_UID
|
||||
#define MAX_UID 1000
|
||||
#endif
|
||||
|
||||
#ifndef MIN_UID
|
||||
#define MIN_UID 1000
|
||||
#endif
|
||||
|
||||
#define VERSION 1_0_3
|
||||
|
||||
// Custom data structure to hold user-entered password
|
||||
struct pam_credentials
|
||||
{
|
||||
const char *password;
|
||||
};
|
||||
|
||||
// PAM conversation function to supply the password
|
||||
int pam_conversation(int num_msg, const struct pam_message **msg,
|
||||
struct pam_response **resp, void *appdata_ptr)
|
||||
{
|
||||
struct pam_response *response = NULL;
|
||||
struct pam_credentials *credentials = (struct pam_credentials *)appdata_ptr;
|
||||
int i;
|
||||
|
||||
response = (struct pam_response *)malloc(sizeof(struct pam_response) * num_msg);
|
||||
if (response == NULL)
|
||||
return PAM_CONV_ERR;
|
||||
|
||||
for (i = 0; i < num_msg; i++) {
|
||||
switch (msg[i]->msg_style) {
|
||||
case PAM_PROMPT_ECHO_ON:
|
||||
case PAM_PROMPT_ECHO_OFF:
|
||||
response[i].resp = strdup(credentials->password);
|
||||
response[i].resp_retcode = 0;
|
||||
break;
|
||||
default:
|
||||
free(response);
|
||||
return PAM_CONV_ERR;
|
||||
}
|
||||
}
|
||||
|
||||
*resp = response;
|
||||
return PAM_SUCCESS;
|
||||
}
|
||||
|
||||
int authenticate(const char *username, const char *password, int verbose)
|
||||
{
|
||||
int retval;
|
||||
pam_handle_t *pamh = NULL;
|
||||
struct pam_credentials credentials = { password };
|
||||
struct pam_conv conv = { pam_conversation, &credentials };
|
||||
|
||||
if (verbose)
|
||||
printf("Starting PAM authentication for user '%s'.\n", username);
|
||||
|
||||
retval = pam_start("login", username, &conv, &pamh);
|
||||
|
||||
if (retval == PAM_SUCCESS) {
|
||||
if (verbose)
|
||||
printf("PAM authentication initialized.\n");
|
||||
retval = pam_authenticate(pamh, 0); // Attempt to authenticate
|
||||
} else {
|
||||
if (verbose)
|
||||
printf("pam_start failed: %s\n", pam_strerror(pamh, retval));
|
||||
}
|
||||
|
||||
if (retval == PAM_SUCCESS) {
|
||||
if (verbose)
|
||||
printf("User '%s' authenticated successfully.\n", username);
|
||||
|
||||
retval = pam_acct_mgmt(pamh, 0); // Check account validity
|
||||
if (retval != PAM_SUCCESS && verbose)
|
||||
printf("pam_acct_mgmt failed: %s\n", pam_strerror(pamh, retval));
|
||||
|
||||
} else {
|
||||
if (verbose)
|
||||
printf("pam_authenticate failed: %s\n", pam_strerror(pamh, retval));
|
||||
}
|
||||
|
||||
if (pam_end(pamh, retval) != PAM_SUCCESS) {
|
||||
pamh = NULL;
|
||||
fprintf(stderr, "Failed to release PAM authenticator\n");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
if (retval != PAM_SUCCESS && verbose) {
|
||||
printf("Authentication failed for user '%s'.\n", username);
|
||||
}
|
||||
|
||||
return (retval == PAM_SUCCESS ? 0 : 1); // 0 for success, 1 for failure
|
||||
}
|
||||
#include "checkpw.h"
|
||||
|
||||
// Function to prompt user for input, optionally hiding input
|
||||
void prompt_for_input(char *buffer, size_t size, const char *prompt,
|
||||
int hide_input)
|
||||
bool hide_input)
|
||||
{
|
||||
printf("%s", prompt);
|
||||
fflush(stdout);
|
||||
|
|
@ -159,41 +63,42 @@ void prompt_for_input(char *buffer, size_t size, const char *prompt,
|
|||
|
||||
void print_usage(const char *prog_name)
|
||||
{
|
||||
fprintf(stderr, "\n");
|
||||
fprintf(stderr, "Usage: %s [-u <username>] [-p <password>] [-i] [-v] [-h]\n", prog_name);
|
||||
fprintf(stderr, "\n");
|
||||
fprintf(stderr, "Options:\n");
|
||||
fprintf(stderr, " -u <username> Specify username.\n");
|
||||
fprintf(stderr, " -p <password> Specify password.\n");
|
||||
fprintf(stderr, " -i Enable interactive mode to prompt for missing username/password.\n");
|
||||
fprintf(stderr, " -v Enable verbose mode.\n");
|
||||
fprintf(stderr, " -V Show program version.\n");
|
||||
fprintf(stderr, " -h Show this help.\n");
|
||||
fprintf(stderr, "\n");
|
||||
printf("\n");
|
||||
printf("Usage: %s [-u <username>] [-p <password>] [-v] [-V] [-h]\n",
|
||||
prog_name);
|
||||
printf("\n");
|
||||
printf("Options:\n");
|
||||
printf(" -u <username> Set username (if not set, the program asks for it).\n");
|
||||
printf(" -p <password> Set password (if not set, the program asks for it).\n");
|
||||
printf(" -v Enable verbose mode.\n");
|
||||
printf(" -V Print program version.\n");
|
||||
printf(" -h Show this help.\n");
|
||||
printf("\n");
|
||||
}
|
||||
|
||||
int main(int argc, char *argv[])
|
||||
{
|
||||
bool interactive = false;
|
||||
bool verbose = false;
|
||||
bool version = false;
|
||||
char username[MAX_USERNAME_LEN] = {0};
|
||||
char password[MAX_PASSWORD_LEN] = {0};
|
||||
char username[MAX_USERNAME_LEN] = {0};
|
||||
int opt;
|
||||
|
||||
// Parse command-line arguments
|
||||
while ((opt = getopt(argc, argv, "u:p:hivV")) != -1) {
|
||||
while ((opt = getopt(argc, argv, "u:p:hvV")) != -1) {
|
||||
switch (opt) {
|
||||
case 'u':
|
||||
if (strlen(optarg) >= MAX_USERNAME_LEN) {
|
||||
fprintf(stderr, "Error: Username is too long (maximum %d characters).\n", MAX_USERNAME_LEN);
|
||||
fprintf(stderr, "Error: Username is too long (maximum %d characters).\n",
|
||||
MAX_USERNAME_LEN);
|
||||
exit(1);
|
||||
}
|
||||
strncpy(username, optarg, MAX_USERNAME_LEN - 1);
|
||||
break;
|
||||
case 'p':
|
||||
if (strlen(optarg) >= MAX_PASSWORD_LEN) {
|
||||
fprintf(stderr, "Error: Password is too long (maximum %d characters).\n", MAX_PASSWORD_LEN);
|
||||
fprintf(stderr, "Error: Password is too long (maximum %d characters).\n",
|
||||
MAX_PASSWORD_LEN);
|
||||
exit(1);
|
||||
}
|
||||
strncpy(password, optarg, MAX_PASSWORD_LEN - 1);
|
||||
|
|
@ -201,9 +106,6 @@ int main(int argc, char *argv[])
|
|||
case 'h':
|
||||
print_usage(argv[0]);
|
||||
exit(0);
|
||||
case 'i':
|
||||
interactive = true;
|
||||
break;
|
||||
case 'v':
|
||||
verbose = true;
|
||||
break;
|
||||
|
|
@ -211,38 +113,27 @@ int main(int argc, char *argv[])
|
|||
version = true;
|
||||
break;
|
||||
default:
|
||||
print_usage(argv[0]);
|
||||
exit(1);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (version) {
|
||||
printf("1.0.3\n");
|
||||
printf("%s\n", VERSION);
|
||||
exit(0);
|
||||
}
|
||||
|
||||
// If interactive mode is enabled, prompt for missing username and/or password
|
||||
if (interactive) {
|
||||
if (username[0] == '\0') {
|
||||
prompt_for_input(username, sizeof(username), "Username: ", 0);
|
||||
if (strlen(username) == 0) {
|
||||
fprintf(stderr, "Error: Username cannot be empty.\n");
|
||||
exit(1);
|
||||
}
|
||||
if (username[0] == '\0') {
|
||||
prompt_for_input(username, sizeof(username), "Username: ", false);
|
||||
if (strlen(username) == 0) {
|
||||
fprintf(stderr, "Error: Username cannot be empty.\n");
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
if (password[0] == '\0') {
|
||||
prompt_for_input(password, sizeof(password), "Password: ", 1);
|
||||
if (strlen(password) == 0) {
|
||||
fprintf(stderr, "Error: Password cannot be empty.\n");
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
// If not in interactive mode, ensure username and password are provided
|
||||
if (username[0] == '\0' || password[0] == '\0') {
|
||||
fprintf(stderr, "Error: Username and password must be provided unless interactive mode is enabled.\n");
|
||||
print_usage(argv[0]);
|
||||
if (password[0] == '\0') {
|
||||
prompt_for_input(password, sizeof(password), "Password: ", true);
|
||||
if (strlen(password) == 0) {
|
||||
fprintf(stderr, "Error: Password cannot be empty.\n");
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
|
@ -254,17 +145,19 @@ int main(int argc, char *argv[])
|
|||
exit(1);
|
||||
}
|
||||
|
||||
// Check if the user's UID is below the minimum allowed UID and not higher than maximum allowed UID
|
||||
// Check if the user's UID is below the minimum allowed UID and not higher
|
||||
// than maximum allowed UID
|
||||
if (pwd->pw_uid < MIN_UID || pwd->pw_uid > MAX_UID) {
|
||||
fprintf(stderr, "Error: User '%s' has a UID less than %d or higher than %d and is not allowed to authenticate.\n", username, MIN_UID, MAX_UID);
|
||||
fprintf(stderr, "Error: User '%s' has a UID higher than %d or lower than %d and is not allowed to authenticate.\n",
|
||||
username, MAX_UID, MIN_UID);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
if (verbose)
|
||||
printf("User '%s' passed UID check (UID: %d).\n", username, pwd->pw_uid);
|
||||
printf("User '%s' passed UID check (UID: %d).\n", username,
|
||||
pwd->pw_uid);
|
||||
|
||||
// Authenticate the user
|
||||
if (authenticate(username, password, verbose) == 0) {
|
||||
if (authenticate(username, password, verbose) == true) {
|
||||
printf("Authenticated successfully.\n");
|
||||
return 0;
|
||||
} else {
|
||||
|
|
|
|||
121
checkpw.h
Normal file
121
checkpw.h
Normal file
|
|
@ -0,0 +1,121 @@
|
|||
/**
|
||||
* checkpw.h is part of checkpw, a program that checks the validity of a users
|
||||
* password on a UNIX/PAM-based system.
|
||||
*
|
||||
* Author: Johannes Findeisen <you@hanez.org> - 2025
|
||||
* License: Apache-2.0 (see LICENSE)
|
||||
*/
|
||||
|
||||
#include <pwd.h>
|
||||
#include <security/pam_appl.h>
|
||||
#include <security/pam_misc.h>
|
||||
|
||||
#define VERSION "1.1.0"
|
||||
|
||||
#ifndef MAX_PASSWORD_LEN
|
||||
#define MAX_PASSWORD_LEN 256
|
||||
#endif
|
||||
|
||||
#ifndef MAX_USERNAME_LEN
|
||||
#define MAX_USERNAME_LEN 32
|
||||
#endif
|
||||
|
||||
#ifndef MAX_UID
|
||||
#define MAX_UID 1000
|
||||
#endif
|
||||
|
||||
#ifndef MIN_UID
|
||||
#define MIN_UID 1000
|
||||
#endif
|
||||
|
||||
bool authenticate(const char *username, const char *password, bool verbose);
|
||||
|
||||
int pam_conversation(int num_msg, const struct pam_message **msg,
|
||||
struct pam_response **resp, void *appdata_ptr);
|
||||
|
||||
struct pam_credentials
|
||||
{
|
||||
const char *password;
|
||||
};
|
||||
|
||||
bool authenticate(const char *username, const char *password, bool verbose)
|
||||
{
|
||||
int retval;
|
||||
pam_handle_t *pamh = NULL;
|
||||
struct pam_credentials credentials = { password };
|
||||
struct pam_conv conv = { pam_conversation, &credentials };
|
||||
|
||||
if (verbose)
|
||||
printf("Starting PAM authentication for user '%s'.\n", username);
|
||||
|
||||
retval = pam_start("login", username, &conv, &pamh);
|
||||
|
||||
if (retval == PAM_SUCCESS) {
|
||||
if (verbose)
|
||||
printf("PAM authentication initialized.\n");
|
||||
retval = pam_authenticate(pamh, 0); // Attempt to authenticate
|
||||
} else {
|
||||
if (verbose)
|
||||
fprintf(stderr, "Error: pam_start failed: %s\n", pam_strerror(pamh,
|
||||
retval));
|
||||
}
|
||||
|
||||
if (retval == PAM_SUCCESS) {
|
||||
if (verbose)
|
||||
printf("User '%s' authenticated successfully.\n", username);
|
||||
|
||||
retval = pam_acct_mgmt(pamh, 0); // Check account validity
|
||||
if (retval != PAM_SUCCESS && verbose)
|
||||
fprintf(stderr, "Error: pam_acct_mgmt failed: %s\n",
|
||||
pam_strerror(pamh, retval));
|
||||
} else {
|
||||
if (verbose)
|
||||
fprintf(stderr, "Error: pam_authenticate failed: %s\n",
|
||||
pam_strerror(pamh, retval));
|
||||
}
|
||||
|
||||
if (pam_end(pamh, retval) != PAM_SUCCESS) {
|
||||
pamh = NULL;
|
||||
fprintf(stderr, "Error: Failed to release PAM authenticator.\n");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
if (retval != PAM_SUCCESS && verbose) {
|
||||
fprintf(stderr, "Error: Authentication failed for user '%s'.\n",
|
||||
username);
|
||||
}
|
||||
|
||||
return (retval == PAM_SUCCESS ? true : false);
|
||||
}
|
||||
|
||||
// PAM conversation function to supply the password
|
||||
int pam_conversation(int num_msg, const struct pam_message **msg,
|
||||
struct pam_response **resp, void *appdata_ptr)
|
||||
{
|
||||
struct pam_response *response = NULL;
|
||||
struct pam_credentials *credentials = (struct pam_credentials *)appdata_ptr;
|
||||
int i;
|
||||
|
||||
response = (struct pam_response *)malloc(sizeof(struct pam_response)
|
||||
* num_msg);
|
||||
|
||||
if (response == NULL)
|
||||
return PAM_CONV_ERR;
|
||||
|
||||
for (i = 0; i < num_msg; i++) {
|
||||
switch (msg[i]->msg_style) {
|
||||
case PAM_PROMPT_ECHO_ON:
|
||||
case PAM_PROMPT_ECHO_OFF:
|
||||
response[i].resp = strdup(credentials->password);
|
||||
response[i].resp_retcode = 0;
|
||||
break;
|
||||
default:
|
||||
free(response);
|
||||
return PAM_CONV_ERR;
|
||||
}
|
||||
}
|
||||
|
||||
*resp = response;
|
||||
return PAM_SUCCESS;
|
||||
}
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue